Privacy Policy – MGM RESORTS INTL.

LAST UPDATED: March 5, 2026

INTRODUCTION

MGM Resorts International values your patronage and respects your privacy. This Privacy Policy (“Policy“) describes the information collection, use, protection, and sharing practices of MGM Resorts International and MGM Resorts International web sites, mobile applications, electronic communications, and properties described below (collectively, “us,” “we,” or “our“). If you have any questions or concerns about this Policy, please contact us at privacy@mgmresorts.com . As used in this Policy, the word “including” means including, without limitation.

This Policy applies only to MGM Resorts International, MGM Resorts International websites (“websites“), mobile applications, social media pages, and other electronic communications that we control and that post this Policy (collectively, “MGM Online Services“), and the following resorts, casinos and properties (which may include facilities and venues located on such premises) (collectively, “MGM Resorts“):

ARIA Resort and Casino (including Sky Suites) in Las Vegas, Nevada
Beau Rivage in Biloxi, Mississippi
Bellagio in Las Vegas, Nevada
Borgata Hotel Casino & Spa in Atlantic City, New Jersey
Dolby Live in Las Vegas, Nevada
Empire City Casino in Yonkers, New York
Excalibur in Las Vegas, Nevada
Fallen Oak in Saucier, Mississippi
Luxor in Las Vegas, Nevada
Mandalay Bay in Las Vegas, Nevada
Mandalay Place in Las Vegas, Nevada
Michelob ULTRA Arena in Las Vegas, Nevada
MGM Grand (including Skylofts and Mansion) in Las Vegas, Nevada
MGM Grand Detroit in Detroit, Michigan
MGM Grand Garden Arena in Las Vegas, Nevada
MGM National Harbor in Oxon Hill, Maryland
MGM Northfield Park in Northfield, Ohio
MGM Springfield in Springfield, Massachusetts
New York-New York in Las Vegas, Nevada
Park MGM in Las Vegas, Nevada
Shadow Creek Golf Course in North Las Vegas, Nevada
The Cosmopolitan of Las Vegas in Las Vegas, Nevada
The Park District in Las Vegas, Nevada
The Reserve at Park MGM in Las Vegas, Nevada
The Signature at MGM Grand in Las Vegas, Nevada
T-Mobile Arena in Las Vegas, Nevada
Vdara Hotel & Spa in Las Vegas, Nevada
W Las Vegas in Las Vegas, Nevada

MGM Resorts International is a corporation subject to the laws of the United States. This Policy describes our information collection, use, protection, and sharing practices in the United States. The United States may not offer a level of privacy protection as great as that offered in other jurisdictions. In jurisdictions outside of the United States where we are subject to different or more restrictive local laws, we may adjust our practices in those jurisdictions to comply with local laws. Otherwise, we make no representation that the practices described in this Policy are compliant with laws outside of the United States that apply to the collection, security, use and disclosure of information. Information that is collected or stored in jurisdictions outside of the United States may, subject to applicable law, be disclosed or transferred to the United States or other locations. When information is transferred to the United States, it will be handled in accordance with the laws of the United States.

1. INFORMATION WE COLLECT

We collect information from a variety of sources and in a variety of ways, including the following:

A. Personal Information.

When you visit, use, and/or access MGM Resorts or MGM Online Services (e.g. sign-up for MGM Rewards loyalty program or book a hotel reservation on a MGM Resorts website), you may provide us with (and/or we may collect) information by which you can be personally identified including your name, date of birth, postal address, e-mail address, telephone number, driver’s license number, government-issued identification card number, passport number, videos, recordings, and images of you (“Personal Information”). For example, we may collect Personal Information when you complete a form, have a card/document scanned/swiped/tapped, or through camera functionality on your mobile device that you enable. We may also obtain Personal Information from third parties.

B. Employment Application Information/Business-to-Business Information.

If you apply for a job with us, we may ask for certain information about you including your work and education history, and your profile/résumé. If you are an employee or other representative of our vendors, business partners, or other third parties, information we obtain about you in the course of your professional relationship with us, such as professional and employment-related data and contact information.

C. Vehicle Information.

Through various ways (including when you park a vehicle at, or otherwise visit, MGM Resorts), we may collect information about a vehicle including an image of the vehicle, the vehicle’s make, model, and license plate number. For example, we collect license plate information through technology known as “Automatic License Plate Recognition” (which captures the images of vehicle license plates and related information such as time/date of image capture) for various safety, security, fraud prevention, and other purposes. This information may also be collected manually (such as at check-in).

D. Purchase and Transaction Information.

When you visit, use and/or access MGM Resorts or MGM Online Services, we may collect information about your activities and actions including your purchases, reservations, and gaming activity (in jurisdictions where gaming is permitted).

E. Sensitive Information.

When you make a purchase, visit, use and/or access MGM Resorts or MGM Online Services (e.g., check-in to hotel (including at the front desk, a kiosk or via mobile check-in) and enter a casino), or engage in other transactions or activities, you may provide us with sensitive Personal Information, which may include your credit or debit card number, financial account number, biometric-related information including physiological or biological characteristics used to establish individual identity, such as fingerprints or facial recognition, medical/health-related information, social security number, naturalization number, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, sex life and sexual orientation, or citizenship or immigration status (“Sensitive Information”). We may collect Sensitive Information through various ways including when you complete a form, have a card/document scanned/swiped/tapped, or through camera functionality on your mobile device that you enable.

F. Wi-Fi and Location Information.

When you use Wi-Fi services we make available at MGM Resorts, we may collect (directly or through third parties) information about the websites you visit, the type of device and browser you are using, your device identification number, your precise physical location, bandwidth used, session time, etc. Even if you choose not to use Wi-Fi services we make available at MGM Resorts, we may still collect information concerning the precise physical location of your mobile device within and around MGM Resorts for Non-Marketing Purposes (defined in Section 3.A. below). With notice or your consent (and regardless of whether you use Wi-Fi service we make available at MGM Resorts), we might also collect information about the precise physical location of your mobile device within and around MGM Resorts for marketing purposes.

G. Device and Browser Information.

When you visit, use, and/or access MGM Online Services, we may collect information about the type of device and browser you are using, the unique number assigned to your server or Internet connection, your physical location, and your interactions with MGM Online Services (including the monitoring and recording of such interactions and reconstructing activity from a session or by a user). We may also use “cookies”, other tracking tools (such as APIs (application programming interface) and SDKs (software development kits)) and similar technologies to help us recognize and serve you better including to analyze technical data from you and for marketing purposes. Cookies are small files that contain information sent by a website that is saved on your computer’s hard drive. Cookies also are used to put a unique identifier on your computer. We use different types of cookies with different purposes depending on where you are located when you visit, use and/or access MGM Online Services. In all jurisdictions, we use cookies that are necessary for the MGM Online Services to function as you would expect. For example, necessary cookies allow you to navigate between web pages and log in to your account. Other types of cookies enable us to gather data such as web pages visited, links clicked, material downloaded, and allow us to record and/or reconstruct activity from a session or by a user. These types of cookies help us to generate statistics regarding usage of MGM Online Services and for troubleshooting, analytics, issue resolution, and other purposes. There are different methods for cookie placement, including “browser” cookies (also known as “html cookies”) and Flash cookies (also known as “Local Shared Objects”). You can configure your browser to reject browser cookies or to notify you when browser cookies are offered so that you can accept or reject them. However, if you reject browser cookies you may not be able to conduct some transactions or use some services on MGM Online Services. In addition, blocking or deleting browser cookies may not block or delete other types of cookies including Flash cookies. In some jurisdictions and on select MGM Online Services’ sites, you may be able to access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html to opt-out of the placement of non-necessary cookies for such select MGM Online Services. To exercise such opt-outs with respect to the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, please access the specific T-Mobile Arena Cookie Settings page on its site or at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively.

H. Social Media Information.

When you use integrated social media features on MGM Online Services, or other social media websites or mobile applications, we may obtain information including your name and e-mail address; and videos, recordings, and images of you.

I. Video Surveillance Information.

When you visit MGM Resorts, we may use video and other surveillance systems to monitor gaming areas and other public and sensitive areas within and around MGM Resorts for safety, security, fraud prevention, and other purposes. Some surveillance systems may incorporate facial recognition technologies, which may be used for additional screening.

J. Audio, electronic, or similar information.

When you call MGM Resorts, for example, to make a hotel reservation, dining reservation, or purchase entertainment tickets, to inquire about your loyalty program account, or otherwise communicate with MGM Resorts via audio, electronic and/or video channels, we may obtain information related to you and your request/inquiry and we may monitor or record such interaction.

K. Other Information.

We may obtain information about you from third parties, including entities that direct you to, are located at, or are accessible via, MGM Online Services or MGM Resorts, business partners, family members, and friends.

L. BetMGM and Other Gaming Information.

If you participate in activities on/at BetMGM-branded gaming platforms/facilities/retail operations or other sports betting, poker, or casino games platforms/facilities/retail operations, we may obtain information from other parties including BetMGM. Such information (e.g., personal identifiers, transaction information, wagering information, interactions, and analytics) may be related to, involving and/or associated with your BetMGM or other gaming account(s) including information that we may use to make services available to you, to associate your BetMGM (or other gaming) account(s) and your MGM loyalty program account, to provide you with marketing offers, to operate our business, to fulfill your requests, and/or to fulfill the terms of our loyalty program and/or the BetMGM loyalty program (and to administer such programs(s)). Such information may also include information to assist us in meeting our legal and regulatory obligations and addressing the fairness, security, and safety of our services, including MGM Online Services.

M. Marriott Bonvoy and Other Related Information.

If you are a Marriott Bonvoy member who books a room at certain MGM Resorts and/or engages in other activities at certain MGM Resorts, we may obtain information from other parties including Marriott International. This may include information related to your Bonvoy account including information that we may use and/or need to make services available to you and/or to associate your Bonvoy account to you and/or your MGM-related activities.

N. Chat Functions.

MGM Online Services may use tools to provide chat features to connect you with chat assistance (including, but not limited to, online, via text message, mobile application, and/or telephone), which may be powered by human interaction, chatbots (which may use artificial intelligence (“AI”)), or a combination of human interaction and chatbots. We may collect the information that you submit to us to provide, improve, and/or develop the chat functionality, so that we can, for example, better respond to your and other customers’ future interactions. We and/or our third-party service providers may record chat sessions, store data associated with those sessions, use such information for quality and training purposes and for other purposes including those contemplated by this Policy. By using our MGM Online Services that include chat functionality, you consent to the collection, recording, retaining, storing, and use by us and our service providers of chat sessions and information that you provide.

O. Surveys.

We may initiate surveys from time to time, including using third-party survey providers. The survey providers collect and process your survey responses on our behalf and provide us the information in response to the surveys. We use survey data to help improve and assess our services, our website, and for other business purposes.

2. INFORMATION COLLECTED BY THIRD PARTIES

A. Interest-Based Advertising.

When you visit, use, and/or access MGM Online Services in some jurisdictions, certain cookies (such as certain cookies placed by third parties), other tracking tools (such as APIs (application programming interfaces) and SDKs (software development kits)), and similar technologies may be used by third parties to collect information at, or through, MGM Online Services and other websites for a variety of purposes including for analytics and for providing you with advertisements. This type of ad-customization is sometimes referred to as “interest-based advertising.” For more information about interest-based advertising please visit https://www.networkadvertising.org/faq.

In relevant jurisdictions and on select MGM Online Services’ sites, you may be able to access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html to opt-out of the placement of non-necessary cookies, including cookies used for interest-based advertising, for such select MGM Online Services. To exercise such opt-outs with respect to the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, please access the specific T-Mobile Arena Cookie Settings page on its site or at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively.

Please note that the use of cookies, web beacons, and similar technologies by third parties at, or through, MGM Online Services is subject to their own privacy policies, not our Policy. If you would like more information about your choices concerning interest-based advertising, including how you may opt-out of some uses of information collected by members of the Network Advertising Initiative and the Digital Advertising Alliance, including those that may collect information at, or through, the MGM Online Services, please visit http://optout.networkadvertising.org/?c=1 and https://optout.aboutads.info/?c=2&lang=EN. At this time, we do not recognize automated browser signals regarding tracking mechanisms, which may include “do not track” instructions. We use a third-party service provider to assist us in responding to opt-out preference signals sent by the Global Privacy Control (“GPC”) standard, a user-enabled setting available in certain internet browsers and browser extensions.

B. Cross-Device Information.

We may use Adobe’s Cross-Device Analytics (CDA) feature and/or other cross-device tracking providers to better understand how you use MGM Online Services across the various devices you use and to deliver tailored promotions. To learn more from Adobe about Cross-Device Analytics, please visit https://business.adobe.com/products/analytics/cross-device-analytics.html.

3. HOW WE USE THE INFORMATION WE COLLECT

A. Use by MGM Resorts International

Marketing Purposes. We may use the information we collect for marketing purposes including notifying you of special promotions, offers, and events via e-mail, direct mail, social media, telephone, text message, push notifications, in-room notifications, and other means (collectively, “Marketing Purposes”). In connection with such Marketing Purposes, we may use your personal information to create and update consumer profiles, determine eligibility for offers and predict preferences, interests and future gaming and spending activities.

Non-Marketing Purposes. We may use the information we collect for non-marketing purposes including (1) validating your identity; (2) recording and accessing gaming-related activity (in jurisdictions where gaming is permitted) and the use of the MGM Online Services and other services; (3) conducting research, analytics, and statistical or demographic analysis; (4) processing, fulfilling, and tracking reservations, purchases, or other transactions such as hotel accommodations, gaming activities, spa services, food and beverage services, retail, activities related to our loyalty program and entertainment, and providing notices and other communications related to them; (5) complying with legal and regulatory requirements; (6) customizing your experience while visiting, using and/or accessing MGM Online Services and/or MGM Resorts; (7) protecting and defending MGM Resorts International and its affiliates against legal actions or claims; (8) preventing fraud and detecting security incidents; (9) collecting debt; (10) satisfying contractual obligations; (11) evaluating employment applications; (12) safety and security purposes including protecting our rights and property, cooperating with law enforcement or other government agencies for purposes of national security, public safety, or matters of public importance when we believe that disclosure of information is necessary or appropriate to protect the public interest; (13) assess and improve our products and services; (14) provide, facilitate, assess and improve MGM Resorts and MGM Online Services; (15) create and update customer profiles; (16) determine your eligibility for casino markers and offers; (17) responding to your inquiries; (18) performing background checks (for example, if you apply for employment with us); (19) process financial transactions; and (20) manage professional development, performance, and conduct (collectively “Non-Marketing Purposes”).

General. When it is possible to do so, we may link Personal Information such as your name or e-mail address with non-Personal Information and other Personal Information. We may also link Personal Information with other generally or publicly available information to help us identify your preferences or interests. The information we collect may also be merged with information available from other sources such as (1) companies that match e-mail addresses with postal addresses and other information; (2) credit card verification and credit services; and (3) other subsidiaries, resorts, casinos, or properties that are owned, operated, or affiliated with MGM Resorts International (each a “MGM Subsidiary”). Behavioral data collected on our websites may later be linked to your profile if you log in or are otherwise identified, in order to personalize your experience, optimize our services, and deliver tailored marketing communications.

B. Sharing within MGM Resorts International and with Subsidiaries

We may share the information we collect for any purpose among MGM Resorts International and any individual MGM Resort, MGM Subsidiary, or MGM Online Service. Sensitive Information will only be shared for Non-Marketing Purposes.

C. Sharing with Business Partners and Other Third Parties

We may share the information we collect with our business partners and other third parties for Non-Marketing purposes and marketing purposes (e.g., joint marketing purposes or our business partners’ (or our own) marketing purposes). Even if you opt-out of permitting us to share your Personal Information with our business partners and other third parties for marketing purposes, we may still share the information we collect with them for Non-Marketing purposes such as processing transactions, fulfilling your requests, responding to your inquiries, analytics (such as analyzing performance and utilization metrics), etc. Sensitive Information will only be shared with our business partners and other third parties for Non-Marketing Purposes. When we provide Sensitive Information or other Personal Information to our business partners and other third parties, we require them to exercise reasonable care to protect such information and restrict the use of such information to the purposes for which it was provided to them.

D. Service Providers and Contractors

We may engage service providers and contractors to provide certain services to us or to perform certain services on our behalf including analytics, fraud and security protection-related services, marketing, fulfillment, etc. In some cases, service providers or contractors may collect or be provided with access to your information as reasonably necessary to perform such services.

E. Certain Business Transactions

We may share any or all of the information we collect (including Sensitive Information) with any successor to all or part of our business in connection with a transaction involving a sale, purchase, reorganization, or transfer of any asset of MGM Resorts International and/or any individual MGM Resort or MGM Online Service.

F. BetMGM

We may disclose information (including personal information about or related to you) to BetMGM, LLC (which is an affiliate of MGM) and its affiliates (collectively, “BetMGM LLC”) for Marketing and Non-Marketing purposes regardless of whether you currently have a gaming account with BetMGM, LLC. Such shared information may include personal identifiers (e.g., name, email address, mailing address, etc.) as well as information related to your gaming and non-gaming activities involving us (e.g., wagering activities and non-gaming transactions at MGM Resorts). Such information, once shared, is also subject to the applicable BetMGM Privacy Policy(ies) available at https://help.ia.betmgm.com/en/general-information/security/privacy-policy-all-states. For example, we may disclose to BetMGM, LLC (and/or others) certain gaming and non-gaming information (subject to compliance with applicable laws and with your consent where required), in order: (1) for BetMGM, LLC, others, and/or us to administer your BetMGM, MGM loyalty and/or other accounts, (2) for BetMGM, LLC and/or us to engage in marketing activities including communications regarding offers, (3) for BetMGM, LLC and/or us to conduct internal research and analytics (e.g., determine eligibility for offers), (4) for regulatory purposes, and (5) for other purposes consistent with this Privacy Policy and/or the applicable BetMGM Privacy Policy(ies) available at https://help.ia.betmgm.com/en/general-information/security/privacy-policy-all-states. For opt-out information specific to your BetMGM accounts and/or BetMGM, LLC, please see Section 4.B. below.

G. Marriott International

Regarding sharing information with Marriott International (and/or others affiliated with or acting on behalf of Marriott International) about and/or related to your Bonvoy account and/or stay(s) (and other activities) at certain MGM Resorts, we will provide Marriott International (or others) with certain information including information related to your stay and other activities at certain MGM Resorts that Marriott and/or others may use and/or need in connection with and/or to administer your Bonvoy account, provide you with information about your stay at certain MGM Resorts and for other purposes consistent with this Privacy Policy and Marriott Group Global Privacy Statement https://www.marriott.com/about/privacy.mi.

H. Social Media Information

MGM Online Services, or other social media websites or mobile applications, may allow you to connect and share information with various social media platforms, such as Facebook, Instagram, and other similar platforms. These features may require us to implement cookies, plug-ins, and/or APIs provided by such social media platforms to facilitate communications and features. We may share information that you provide us or that we may collect about your use of MGM Online Services with these various platforms, and such information becomes subject to their privacy and data policies when we do so. See Sections 3.A. and 3.C. for additional information.

We may also use the advertising services and networks offered by social media platforms, such as Facebook, Instagram, and other similar platforms, to deliver ad content. We may disclose personal information to these social media platforms to allow such platforms to identify similar platform users that may be interested in our ad content. Use of these services requires the social media platform to implement cookies and/or pixels and similar technologies to deliver ads to you while online with such platforms. If you are a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia resident, please see the applicable state-specific sections below for more information about your choices with respect to your personal information and online targeted advertising (also known as cross-context behavioral advertising) through the use of cookies and similar technologies.

4. YOUR COMMUNICATION PREFERENCES

A. For MGM Rewards Program Members Only: Using the MGM Online Preference Center to Update Your Marketing Communication Preferences (Including How to Opt-Out of Marketing from Us)

To review and/or update your marketing preferences (including how to opt-of receiving marketing solicitations from us) please login to your MGM Rewards Loyalty account here https://www.mgmresorts.com/en/sign-in.html, select “Preferences” then “Manage Preferences”. Within the Preference Center, you can manage which MGM Resorts Property you choose to receive marketing communications from, if any. You can also manage among various communications preferences including e-mail, mail, phone, text message and push notification. See Sections 4.B. and 4.D. for details on how to opt-out from having your Personal Information shared and/or sold to certain third parties for marketing purposes.

B. For All (including MGM Rewards Program Members): How to Opt-Out of Marketing from Us (Additional Options) and How to Opt-Out of Having Your Personal Information Shared with Others for Marketing Purposes

Regardless of whether or not you have a MGM Rewards Program account, you have the following options related to marketing solicitations.

If you wish to opt-out of receiving marketing solicitations from us via email, mail, phone, text message and push notification, or you do not want us to share your Personal Information for marketing purposes with our business partners or other third parties, or with any individual MGM Resort, or MGM Subsidiary please submit your request via e-mail at optout@mgmresorts.com; via telephone at (866)-761-7111; or via postal mail, with your specific request(s) at:

MGM Resorts International

Corporate Compliance Department

Attn: OPT-OUT

71 E. Harmon

Las Vegas, NV 89109

Although you may opt-out of the use and sharing of Personal Information for marketing purposes, we may still use and share information we collect for Non-Marketing Purposes. For example, even if you choose to opt-out from marketing-related communications, we will continue to send you transactional messages about your reservations or stays.

Please note, if you would like to submit a request to opt-out of marketing or otherwise exercise any other rights or request information related to a BetMGM account and/or BetMGM, LLC, please contact BetMGM, LLC at optout@betmgm.com or:

BetMGM, LLC

Attn: Privacy Policy

Harborside Plaza 2, Suite 700

200 Hudson Street

Jersey City, NJ 07311

C. How to Opt-Out of Online Tracking

For information on how to opt-out of some uses of information collected by third-party advertising companies at (or through) MGM Online Services, please visit http://optout.networkadvertising.org/?c=1 and https://optout.aboutads.info/?c=2&lang=EN. In addition, in some jurisdictions, you may be able to access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, to opt-out of third-party cookies used for interest-based advertising (Targeting Cookies).

D. State Specific Opt-Out Rights

Nevada Residents. Nevada law gives consumers in Nevada the right to restrict certain businesses from selling certain Personal Information to certain unaffiliated third parties. To exercise this right (for Nevada residents only), please visit www.mgmresorts.com/dsar and follow the instructions and provide the requested information including your complete name, street address, city, state, zip code, and email address.

California Residents – Your California Privacy Rights.

California Shine the Light Law: California law requires certain businesses to respond to requests from California residents asking about the disclosure of Personal Information to third parties for third party marketing purposes. Alternatively, such businesses may adopt a policy of not disclosing Personal Information to third parties for marketing purposes if a California resident has opted-out of such information sharing. We have adopted an opt-out policy. If you wish to opt-out of our sharing your Personal Information with third parties for marketing purposes, please follow the instructions in Section 4.B. above.
California Consumer Privacy Act and Privacy Rights Act: If you are a California consumer, please see Section 5 of this Privacy Policy called “California Consumer Privacy Statement” for more information about your privacy rights under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (such laws/regulations are collectively, “CCPA” and such privacy rights are, collectively, “California Privacy Rights”).

Colorado Residents – Your Colorado Privacy Rights. If you are a Colorado consumer, please see Section 6 of this Privacy Policy called “Colorado Privacy Rights” for more information about your privacy opt-out rights under the Colorado Privacy Act as amended and its implementing rules (such law/rules are collectively, “Colorado Privacy Law” and such privacy rights are, collectively, “Colorado Privacy Rights”).

Connecticut Residents – Your Connecticut Privacy Rights. If you are a Connecticut consumer, please see Section 7 of this Privacy Policy called “Connecticut Privacy Rights” for more information about your privacy opt-out rights under the Connecticut Data Privacy Act as amended (such law is hereinafter, “Connecticut Privacy Law” and such privacy rights are, collectively, “Connecticut Privacy Rights”).

Delaware Residents – Your Delaware Privacy Rights. If you are a Delaware consumer, please see Section 8 of this Privacy Policy called “Delaware Privacy Rights” for more information about your privacy opt-out rights under the Delaware Personal Data Privacy Act as amended (such law is hereinafter, “Delaware Privacy Law” and such privacy rights are, collectively, “Delaware Privacy Rights”).

Indiana Residents – Your Indiana Privacy Rights. If you are an Indiana consumer, please see Section 9 of this Privacy Policy called “Indiana Privacy Rights” for more information about your privacy opt-out rights under the Indiana Consumer Data Protection Act as amended (such law is hereinafter, “Indiana Privacy Law” and such privacy rights are, collectively, “Indiana Privacy Rights”).

Iowa Residents – Your Iowa Privacy Rights. If you are an Iowa consumer, please see Section 10 of this Privacy Policy called “Iowa Privacy Rights” for more information about your privacy opt-out rights under the Iowa Consumer Data Protection Act as amended (such law is hereinafter, “Iowa Privacy Law” and such privacy rights are, collectively, “Iowa Privacy Rights”).

Kentucky Residents – Your Kentucky Privacy Rights. If you are a Kentucky consumer, please see Section 11 of this Privacy Policy called “Kentucky Privacy Rights” for more information about your privacy opt-out rights under the Kentucky Consumer Data Protection Act as amended (such law is hereinafter, “Kentucky Privacy Law” and such privacy rights are, collectively, “Kentucky Privacy Rights”).

Maryland Residents – Your Maryland Privacy Rights. If you are a Maryland consumer, please see Section 12 of this Privacy Policy called “Maryland Privacy Rights” for more information about your privacy opt-out rights under the Maryland Online Data Privacy Act as amended (such law is hereinafter, “Maryland Privacy Law” and such privacy rights are, collectively, “Maryland Privacy Rights”).

Minnesota Residents – Your Minnesota Privacy Rights. If you are a Minnesota consumer, please see Section 13 of this Privacy Policy called “Minnesota Privacy Rights” for more information about your privacy opt-out rights under the Minnesota Consumer Data Privacy Act as amended (such law is hereinafter, “Minnesota Privacy Law” and such privacy rights are, collectively, “Minnesota Privacy Rights”).

Montana Residents – Your Montana Privacy Rights. If you are a Montana consumer, please see Section 14 of this Privacy Policy called “Montana Privacy Rights” for more information about your privacy opt-out rights under the Montana Consumer Data Privacy Act as amended (such law is hereinafter, “Montana Privacy Law” and such privacy rights are, collectively, “Montana Privacy Rights”).

Nebraska Residents – Your Nebraska Privacy Rights. If you are a Nebraska consumer, please see Section 15 of this Privacy Policy called “Nebraska Privacy Rights” for more information about your privacy opt-out rights under the Nebraska Data Privacy Act as amended (such law is hereinafter, “Nebraska Privacy Law” and such privacy rights are, collectively, “Nebraska Privacy Rights”).

New Hampshire Residents – Your New Hampshire Privacy Rights. If you are New Hampshire consumer, please see Section 16 of this Privacy Policy called “New Hampshire Privacy Rights” for more information about your privacy opt-out rights under the New Hampshire Privacy Act as amended (such law is hereinafter, “New Hampshire Privacy Law” and such privacy rights are, collectively, “New Hampshire Privacy Rights”).

New Jersey Residents – Your New Jersey Privacy Rights. If you are a New Jersey consumer, please see Section 17 of this Privacy Policy called “New Jersey Privacy Rights” for more information about your privacy opt-out rights under the New Jersey Data Privacy Act as amended and its implementing rules and regulations (such law/rules/regulations are hereinafter, “New Jersey Privacy Law” and such privacy rights are, collectively, “New Jersey Privacy Rights”).

Oregon Residents – Your Oregon Privacy Rights. If you are an Oregon consumer, please see Section 18 of this Privacy Policy called “Oregon Privacy Rights” for more information about your privacy opt-out rights under the Oregon Consumer Privacy Act as amended (such law is hereinafter, “Oregon Privacy Law” and such privacy rights are, collectively, “Oregon Privacy Rights”).

Rhode Island Residents – Your Rhode Island Privacy Rights. If you are a Rhode Island consumer, please see Section 19 of this Privacy Policy called “Rhode Island Privacy Rights” for more information about your privacy opt-out rights under the Rhode Island Data Transparency and Privacy Protection Act as amended (such law is hereinafter, “Rhode Island Privacy Law” and such privacy rights are, collectively, “Rhode Island Privacy Rights”).

Tennessee Residents – Your Tennessee Privacy Rights. If you are a Tennessee consumer, please see Section 20 of this Privacy Policy called “Tennessee Privacy Rights” for more information about your privacy opt-out rights under the Tennessee Information Protection Act as amended (such law is hereinafter, “Tennessee Privacy Law” and such privacy rights are, collectively, “Tennessee Privacy Rights”).

Texas Residents – Your Texas Privacy Rights. If you are a Texas consumer, please see Section 21 of this Privacy Policy called “Texas Privacy Rights” for more information about your privacy opt-out rights under the Texas Data Privacy and Security Act as amended (such law is hereinafter, “Texas Privacy Law” and such privacy rights are, collectively, “Texas Privacy Rights”).

Utah Residents – Your Utah Privacy Rights. If you are a Utah consumer, please see Section 22 of this Privacy Policy called “Utah Privacy Rights” for more information about your privacy opt-out right under the Utah Consumer Privacy Act as amended (such law is hereinafter, “Utah Privacy Law” and such privacy rights are, collectively, “Utah Privacy Rights”).

Virginia Residents – Your Virginia Privacy Rights. If you are a Virginia consumer, please see Section 23 of this Privacy Policy called “Virginia Privacy Rights” for more information about your privacy opt-out right under the Virginia Consumer Data Protection Act of 2021 as amended (such law is hereinafter, “Virginia Privacy Law: and such privacy rights are, collectively, “Virginia Privacy Rights”).

Washington Consumers – Your Consumer Health Data Privacy. If you are a Washington consumer (as defined under the Washington My Health My Data Act), please see our Washington Consumer Health Data Privacy Policy, available at https://www.mgmresorts.com/en/washington-policy.html for information about how to exercise certain health privacy rights regarding consumer health data.

E. How to Opt-Out of Receiving Telemarketing Calls from Us

Even if you registered your telephone number on a do-not-call list, certain exemptions may allow us to contact you by telephone. However, to honor your preferences, we also maintain our own internal do-not-call list. If you would like to opt-out of receiving telemarketing sales calls from us, you can add your telephone number to our internal do- not-call list by submitting your request via e-mail at optout@mgmresorts.com; via telephone at (866)-761-7111; or via postal mail, with your specific request(s) at:

MGM Resorts International

Corporate Compliance Department

Attn: OPT-OUT

71 E. Harmon

Las Vegas, NV 89109

5. CALIFORNIA CONSUMER PRIVACY STATEMENT – APPLICABLE ONLY TO CALIFORNIA RESIDENTS

A. Notice of Collection and Use of Personal Information

i. Categories of Personal Information Collected.

We may collect (and may have collected during the 12-month period prior to the Last Updated date of this Privacy Policy) the following categories of personal information about you:

Identifiers: Identifiers such as name, e-mail address, postal mail address, telephone number, date of birth, credit card number, passport number, driver’s license number, bank account number, social security number, and internet protocol address.
Additional Data Subject to Cal. Civ. Code § 1798.80(e): Including signature, physical characteristics or description, state identification card number, insurance policy number, education, debit card number, and other financial information, medical information, and health insurance information.
Protected Classifications: Characteristics of protected classifications under California or federal law, such as race, color, national origin, age, sex, gender, gender identity, sexual orientation, and military and veteran status.
Commercial Information: Including your gaming-related information, entertainment, travel, dining, lodging, purchase history, and business transactions.
Biometric Information: Biometric-related information including physiological or biological characteristics used to establish individual identity, such as fingerprints or facial recognition.
Online Activity: Internet or other similar electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications, or advertisements.
Geolocation Data.
Sensory Information: Audio, electronic, visual, thermal, olfactory, or similar information.
Employment Information: Professional or employment-related information; union membership.
Education Information: Defined by CCPA as education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act.
Inferences: Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

ii. Business or Commercial Purposes for Which Information was Collected.

We may use (and may have used during the 12-month period prior to the Last Updated date of this Privacy Policy) the categories of personal information listed above for the purposes described in our Privacy Policy. In addition, we may use these categories of personal information for certain business or commercial purposes, as follows:

Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes.
Debugging to identify and repair errors that impair existing intended functionality.
Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with our business.
Performing services on behalf of our business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of our business.
Providing advertising and marketing services to the consumer.
Undertaking internal research for technological development and demonstration.
Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by our business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by our business.

iii. Categories of Sources from Which Information was Collected.

During the 12-month period prior to the Last Updated date of this Privacy Policy, we may have obtained personal information about you from the following categories of sources:

Information you provide directly to us and that is collected at MGM Resorts (See Sections 1.A., 1.B., 1.C., 1.D., 1.E., 1.I., and 1.J.).
Information automatically collected through MGM websites, social media platforms, and online advertising services (See Sections 1.G. and 1.H.).
Information obtained from other sources, including service providers, contractors, third-party services, data analytics providers, other vendors, joint marketing and business partners, recruiting and talent agencies, job references, such as your employers or teachers, data brokers, such as public databases, credit bureaus, credit reporting service providers and background check services, and government-related entities (See Sections 1.B.,1.K., 1.L., and 1.M.).
Information we automatically collect through the MGM mobile apps, including location information (See Section 1.G.).
Information we automatically collect when you use our Wi-Fi services (See Section 1.F.).
Information we automatically collect from mobile devices at MGM Resorts (See Section 1.F.).
Other information we collect related to your gaming and purchase history and interactions with us (See Sections 1.D., 1.L., and 1.M.).

iv. Sale or Sharing of Personal Information.

We do not sell your personal information in exchange for monetary compensation. We may sell or share your personal information for non-monetary compensation by allowing certain third parties (such as online advertising services and marketing partners) to collect personal information (i) via automated technologies on our websites and apps for cross-context behavioral advertising purposes and/or (ii) for marketing-related purposes. This kind of sharing may be considered a “sale or sharing” under California law when the personal information is exchanged for non-monetary compensation. You have the right to opt out of these types of disclosures of your information.

We may sell or share for cross-context behavioral advertising purposes and/or marketing-related purposes (and may have sold or shared during the 12-month period prior to the Last Updated date of this Privacy Policy) the following categories of personal information about you to online advertising services and/or marketing partners:

Identifiers
Commercial Information
Online Activity
Inferences

You have the right to opt-out of this disclosure of your information, as detailed above. We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

v. Disclosure of Personal Information.

During the 12-month period prior to the Last Updated date of this Privacy Policy, we may have disclosed your personal information to certain categories of third parties, as described below.

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

Category of Personal Information	Category of Third Party
Identifiers	Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers.
Additional Data Subject to Cal. Civ. Code § 1798.80(e)	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Protected Classifications	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Commercial Information	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Biometric Information	Third party service providers; third party business partners.
Online Activity	Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers.
Geolocation Data	Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers.
Sensory Information	Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers.
Employment Information	Third party service providers (e.g., employers of consultants); third party business partners; credit reporting agencies; data analytics providers.
Education Information	Third party service providers; third party business partners.
Inferences	Third party service providers; third party business partners; digital advertising providers.
Sensitive Personal Information	Third party service providers; third party business partners; credit reporting agencies.

In addition to the categories of third parties identified above, during the 12-month period prior to the Last Updated date of this Privacy Policy, we may have disclosed personal information about you to government, law enforcement, or regulatory entities (e.g., in response to subpoenas or gaming regulator requests) and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.

vi. Retention of Personal Information.

We will retain your personal information for the time period reasonably necessary to achieve the purposes described in this Privacy Policy and this California Consumer Privacy Statement, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law..

vii. Deidentified Information.

To the extent we process deidentified information (as defined under CCPA), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

B. California Consumer Privacy Rights

If you are a California resident, you may have certain rights, as described below. These rights, which are discussed more fully below, are subject to some important exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. You have the right not to be discriminated against for exercising your California Privacy Rights. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. You also have the right to designate an authorized agent to exercise your California Privacy Rights on your behalf.

If you need this Policy in an alternative, accessible format due to a disability, please send an email with your name and contact information to privacy@mgmresorts.com.

i. Requests To Know About Your Personal Information

You may have the right to request that we disclose to you, for the relevant time period as required by applicable law, the following: (1) the categories of Personal Information we have collected about you, (2) the categories of sources from which Personal Information was collected about you, (3) the business or commercial purpose for which your Personal Information was collected, sold, or shared, and (4) the categories of third parties to whom we have disclosed your Personal Information. In addition, you may have the right to request that we disclose to you the specific pieces of Personal Information we have about you for the relevant time period required by applicable law. We are required to fulfill these requests no more than twice within a 12-month period.

ii. Requests To Delete Your Personal Information

You may have the right to request that we delete your Personal Information, subject to certain exceptions such as our need to comply with legal obligations, fulfill orders, and complete transactions.

iii. Requests To Opt-Out Of Sale Or Sharing Of Your Personal Information

You have the right to opt-out of having your Personal Information sold to or shared with third parties. The use of certain cookies (such as certain cookies placed by third parties) on our sites may constitute a sale or sharing of personal information under CCPA. In addition to submitting your request or calling us, as described below in “How To Submit A Request,” (subsection vi.) you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal) to fully exercise your California Privacy Rights opt-out rights. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale or sharing of your Personal Information, we may still (a) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with CCPA, and (b) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

With respect to cookies and similar technologies, we disclose the categories of Personal Information listed below for online advertising purposes, and/or marketing-related purposes, and to provide third party social network features and functionality on our websites. During the 12-month period from the Last Updated date of this Privacy Policy, we may have sold or shared (as defined under CCPA) the following categories of Personal Information about you to online advertising services, social networks, and/or marketing partners: Identifiers, Commercial Information, Online Activity, and Inferences.

iv. Requests To Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions.

v. Use And Disclosure Of Sensitive Personal Information

We do not use or disclose Sensitive Personal Information (as defined under CCPA) for purposes of inferring characteristics about a consumer.

vi. How To Submit A Request

If you are a California resident, and wish to submit a Request to Know (Section 5.B.i.), Request to Delete (Section 5.B.ii.), Request to Opt-out of Sale or Sharing (Section 5.B.iii.), or Request to Correct Inaccurate Personal Information (Section 5.B.iv.), please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and provide the identifying information requested. All Requests to Know, Delete, and Correct are subject to verification of your identity to protect the privacy and security of your Personal Information.

vii. Verification Procedures

In order to verify requests made pursuant to the CCPA, we may require at least two (2) pieces of identifying information (e.g., email address, street address, etc.) that match information maintained by us. In some cases, we may require additional identifying information and a signed declaration attesting to your identity. If you do not respond to our emails or other communications, or fail to timely provide information we request, we may be unable to fulfill your request.

A Request to Opt-out of Sale or Sharing (Section 5.B.iii.) need not be verified. However, if we have a good-faith, reasonable basis to believe that an opt-out request is fraudulent, we may deny the request and provide an explanation of the reason for the denial.

In certain circumstances, we may decline a request to exercise the Right to Know (Section 5.B.i.), Right to Delete (Section 5.B.ii.), or Right to Correct Inaccurate Personal Information (Section 5.B.iv.) described above, particularly where we are unable to verify your identity.

viii. Authorized Agent

If you would like an authorized agent to submit a privacy request on your behalf, please have the authorized agent visit www.mgmresorts.com/dsar and provide the requested identifying information of both you and your authorized agent. We may need to contact you as these requests may include additional validation steps depending on the nature of the request. If we receive a request from an authorized agent on your behalf, we may: (a) require authorization signed by you to verify that the agent is, in fact, authorized to act on your behalf; and (b) take steps to verify your identity (except for requests to “Do Not Sell or Share My Information”). These steps are intended to protect the privacy and security of your Personal Information.

C. Notice of Financial Incentive

Based on your commercial activity and other factors, we may offer you various financial incentives such as discounts and special offers when you provide us with Personal Information (such as your name, email address, phone number, postal address, and date of birth) to sign-up for our loyalty program, MGM Rewards. When you sign-up for our loyalty program, you opt-in to receive financial incentives.

Under our MGM Rewards program, you can receive financial incentives (benefits) based on certain purchases and other activities related to gaming, dining, hotel, entertainment, and more. You can join (opt-in to) the MGM Rewards program and find program details, terms and conditions at http://www.mgmrewards.com/. You may withdraw (opt-out) from receiving such financial incentives at any time by deactivating your loyalty program account. To deactivate your loyalty program account, visit www.mgmresorts.com/dsar and provide your identifying information as requested. The financial incentives offered in connection with MGM Rewards are reasonably related to the value of a consumer’s data including the commercial activities of such consumer. We calculate the value of a consumer’s data based on various factors, including the consumer’s commercial activities and the expenses related to the offer, provision, or imposition of the financial incentives (benefits) to such consumer.

6. COLORADO PRIVACY RIGHTS – APPLICABLE ONLY TO COLORADO RESIDENTS

If you are a Colorado resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 6.A. below); (B) request that we correct your inaccurate Personal Information (see Section 6.B. below); (C) request that we delete your Personal Information (see Section 6.C. below); (D) obtain a portable copy of your Personal Information (see Section 6.D. below); and (E) opt-out of the sale of your Personal Information and processing of your Personal Information for purposes of online targeted advertising (see Section 6.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. If you need this Policy in an alternative, accessible format due to a disability, please send an email with your name and contact information to privacy@mgmresorts.com.

We may collect, use and share personal data for certain processing purposes, including those described in the chart below. For more information on the categories of personal data we may collect and how we may use such personal data, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Colorado Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law. We do not sell your personal information in exchange for monetary compensation. We may disclose your personal information for non-monetary compensation by allowing certain third parties (such as online advertising services and marketing partners) to collect personal information (i) via automated technologies on our websites and apps for online targeted advertising purposes and/or (ii) for marketing-related purposes. This kind of sharing may be considered a “sale” under Colorado Privacy Law when the personal information is exchanged for non-monetary compensation.

Category of Personal Data	Processing Purpose(s)	Used for Online Targeted Advertising?	Sold or Shared
Personal Information	Notify you of special promotions, offers, and events via e-mail, direct mail, social media, telephone, text message, push notifications, in-room notifications, and other means; Validate your identity; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Employment Application Information	Perform background checks (for example, if you apply for employment with us); Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers (e.g., employers of consultants); third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Vehicle Information	Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Purchase and Transaction Information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Process financial transactions; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Sensitive Personal Information (as defined by applicable Colorado privacy law)	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Internal market research and analytics; Generate statistical studies; Determine your eligibility for casino markers and offers; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Process biometric-related information including physiological or biological characteristics used to establish individual identity, such as fingerprints or facial recognition; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies); government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Wi-Fi and Location Information	Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Device and Browser Information	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners.Shared With: Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Social Media Information	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners. Shared With: Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Video Surveillance Information	Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Audio, electronic, or similar information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
BetMGM and Other Gaming Information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request; Process financial transactions; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/AShared With: Third party service providers; third party business partners; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).

In addition to the categories of third parties identified above, we may have disclosed personal information about you to government, law enforcement, or regulatory entities (e.g., in response to subpoenas or gaming regulator requests) and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Colorado resident, and wish to request this information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Colorado resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Colorado resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Colorado resident, and wish to request this information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Colorado Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Colorado resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Colorado Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as defined by Colorado Privacy Law.

F. Authentication Procedures

In order to verify requests made pursuant to Colorado Privacy Law, we may require at least two (2) pieces of identifying information (e.g., email address, street address, etc.) that match information maintained by us. In some cases, we may require additional identifying information and a signed declaration attesting to your identity. If you do not respond to our emails or other communications, or fail to timely provide information we request, we may be unable to fulfill your request.

In certain circumstances, we may decline a request to exercise a right described above, particularly where we are unable to verify your identity.

G. Authorized Agent

If you would like an authorized agent to submit a request on your behalf to opt-out of the sale of your Personal Information, then please have the authorized agent visit www.mgmresorts.com/dsar and provide the requested identifying information of both you and your authorized agent. If you would like an authorized agent to submit a request on your behalf to opt-out of online targeted advertising involving the use of cookies and similar technologies, then please have the authorized agent contact us at privacy@mgmresorts.com for instructions. We may need to contact you as these requests may include additional validation steps depending on the nature of the request. If we receive a request from an authorized agent on your behalf, then we may: (1) require authorization signed by you to verify that the agent is, in fact, authorized to act on your behalf; and (2) take steps to verify your identity. These steps are intended to protect the privacy and security of your Personal Information.

H. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Colorado resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar.

I. Bona Fide Loyalty Program

If you exercise your right to request deletion of your Personal Information, it will be impossible for us to continue providing loyalty program benefits to you because we will no longer have the information required to provide you with certain benefits. Sensitive Personal Information (as defined by Colorado Privacy Law), such as your citizenship information, may be provided to us if you provide your passport for identity verification purposes during the sign-up process. Although you are required to provide government-issued identification to receive loyalty program benefits due to legal obligations (including gaming regulations), you are not required to provide a passport containing such information.

The categories of Personal Information or Sensitive Personal Information collected through our loyalty program that may be sold or processed for online targeted advertising through the use of cookies and similar technologies include identifiers (such as your name, email address, phone number, postal address, and date of birth) and commercial information (such as your purchases and other activities related to gaming, dining, hotel, and entertainment).

The categories of Third Parties that may receive the Personal Information or Sensitive Personal Information collected through our loyalty program include, third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers. The Personal Information or Sensitive Personal Information collected through our loyalty program will not be provided to Data Brokers, as defined by Colorado Privacy Law.

The following is a list of our loyalty program partners and the loyalty program benefits provided by each loyalty program partner. For complete terms and conditions regarding potential benefits, please visit https://www.mgmresorts.com/en/mgm-rewards/preferred-partners.html.

Loyalty Program Partner	Benefit Provided
Anita Mann Productions, Inc.	MGM Rewards members may be eligible for discounts on tickets for select shows produced by Anita Mann Productions, Inc.
Avis	MGM Rewards members may be eligible for discounts on certain Avis rental rates.
BetMGM	MGM Rewards members may earn benefits in the MGM Rewards program based on qualifying BetMGM activities.
Carrot Top, Inc.	MGM Rewards members may be eligible for discounts on tickets for select shows produced by Carrot Top, Inc.
Celebrity Cruises	Qualifying Platinum and NOIR MGM Rewards members may be eligible to receive a complimentary cruise. MGM Rewards members may be eligible for onboard benefits and offers.
Cirque du Soleil Nevada Newco, Inc.	MGM Rewards members may be eligible for discounts on tickets for select Cirque du Soleil performances.
David Copperfield’s Disappearing, Inc.	MGM Rewards members may be eligible for discounts on tickets for select shows produced by David Copperfield’s Disappearing, Inc.
EM Group	MGM Rewards members may be eligible for discounts on tickets for select exhibitions produced by EM Group.
First National Bank of Omaha	Qualified applicants for the MGM Rewards Mastercard, issued by First National Bank of Omaha, may be eligible to earn MGM Mastercard Points and Tier Credits when using their MGM Rewards Mastercard.
Imagine Exhibitions, Inc.	MGM Rewards members may be eligible for discounts on tickets for select exhibitions produced by Imagine Exhibitions, Inc.
JBWKS LV Theater, LLC	MGM Rewards members may be eligible for discounts on tickets for select shows produced by JBWKS LV Theater, LLC.
Marriott Bonvoy	MGM Rewards members may be eligible for certain benefits/offers.
Mojave Ghost, LLC	MGM Rewards members may be eligible for discounts on tickets for select shows produced by Mojave Ghost, LLC.
Royal Caribbean International	Qualifying Platinum and NOIR MGM Rewards members may be eligible to receive a complimentary cruise. MGM Rewards members may be eligible for onboard benefits and offers.
Southwest Airlines	MGM Rewards members who are also Southwest Rapid Rewards® Members may earn Southwest benefits based on eligible hotel stays.
SPI Entertainment, Inc.	MGM Rewards members may be eligible for discounts on tickets for select shows produced by SPI Entertainment, Inc.
Thunder Valley Casino Resort	MGM Rewards members may be eligible to receive certain benefits and offers through Thunder Valley Casino Resort.

7. CONNECTICUT PRIVACY RIGHTS – APPLICABLE ONLY TO CONNECTICUT RESIDENTS

If you are a Connecticut resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 7.A. below); (B) request that we correct your inaccurate Personal Information (see Section 7.B. below); (C) request that we delete your Personal Information (see Section 7.C. below); (D) obtain a portable copy of your Personal Information (see Section 7.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 7.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Connecticut Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Connecticut resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Connecticut resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Connecticut resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Connecticut resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Connecticut Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Connecticut resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Connecticut Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, as defined by Connecticut Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Connecticut resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

8. DELAWARE PRIVACY RIGHTS – APPLICABLE ONLY TO DELAWARE RESIDENTS

If you are a Delaware resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 8.A. below); (B) request that we correct your inaccurate Personal Information (see Section 8.B. below); (C) request that we delete your Personal Information (see Section 8.C. below); (D) obtain a portable copy of your Personal Information (see Section 8.D. below); (E) request a list of categories of third parties (see Section 8.E. below); and (F) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 8.F. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Delaware Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Delaware resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Delaware resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Delaware resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Delaware resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests for List of Categories of Third Parties

You have the right to request a list of the categories of third parties to which we have disclosed your Personal Information, subject to certain exceptions. If you are a Delaware resident and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

F. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Delaware Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Delaware resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Delaware Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, as defined by Delaware Privacy Law.

G. Authorized Agent

H. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Delaware resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

9. INDIANA PRIVACY RIGHTS – APPLICABLE ONLY TO INDIANA RESIDENTS

If you are an Indiana resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 9.A. below); (B) request that we correct your inaccurate Personal Information (see Section 9.B. below); (C) request that we delete your Personal Information (see Section 9.C. below); (D) obtain a portable copy of your Personal Information (see Section 9.D. below); and (E) opt-out of processing of your Personal Information for purposes of online targeted advertising (see Section 9.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Indiana Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are an Indiana resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are an Indiana resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are an Indiana resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are an Indiana resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes

You have the right to opt-out of the processing of your Personal Information for purposes of online targeted advertising (which involves the use of cookies and similar technologies). If you are an Indiana resident and wish to opt-out of such processing of your Personal Information, then please access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies to exercise your Indiana Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools.

We do not “sell” Personal Information or engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as those terms are defined by Indiana Privacy Law.

F. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are an Indiana resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar on your device and turn off Targeting Cookies to exercise your Indiana Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools.

We do not “sell” Personal Information or engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as those terms are defined by Indiana Privacy Law.

F. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are an Indiana resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

G. Disclosure of Personal Information.

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

Category of Personal Information	Category of Third Party
Identifiers	Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers.
Protected Classifications	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Commercial Information	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Biometric Information	Third party service providers; third party business partners.
Online Activity	Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers.
Geolocation Data	Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers.
Sensory Information	Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers.
Employment Information	Third party service providers (e.g., employers of consultants); third party business partners; credit reporting agencies; data analytics providers.
Education Information	Third party service providers; third party business partners.
Inferences	Third party service providers; third party business partners; digital advertising providers.
Sensitive Personal Information	Third party service providers; third party business partners; credit reporting agencies.

10. IOWA PRIVACY RIGHTS – APPLICABLE ONLY TO IOWA RESIDENTS

If you are an Iowa resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 10.A. below); (B) request that we delete your Personal Information (see Section 10.B. below); (C) obtain a portable copy of your Personal Information (see Section 10.C. below); and (D) opt-out of processing of your Personal Information for purposes of online targeted advertising (see Section 10.D. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are an Iowa resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us, subject to certain exceptions. If you are an Iowa resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are an Iowa resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Opt-Out of Processing for Specified Purposes

You have the right to opt-out of the processing of your Personal Information for purposes of online targeted advertising (which involves the use of cookies and similar technologies). If you are an Iowa resident and wish to opt-out of such processing of your Personal Information, then please access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies to exercise your Iowa Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. We do not “sell” Personal Information, as defined by Iowa Privacy Law.

11. KENTUCKY PRIVACY RIGHTS – APPLICABLE ONLY TO KENTUCKY RESIDENTS

If you are a Kentucky resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 11.A. below); (B) request that we correct your inaccurate Personal Information (see Section 11.B. below); (C) request that we delete your Personal Information (see Section 11.C. below); (D) obtain a portable copy of your Personal Information (see Section 11.D. below); and (E) opt-out of processing of your Personal Information for purposes of online targeted advertising (see Section 11.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Kentucky Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Kentucky resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Kentucky resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Kentucky resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are a Kentucky resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes

You have the right to opt-out of the processing of your Personal Information for purposes of online targeted advertising (which involves the use of cookies and similar technologies). If you are a Kentucky resident and wish to opt-out of such processing of your Personal Information, then please access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies to exercise your Kentucky Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools.

We do not “sell” Personal Information or engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as those terms are defined by Kentucky Privacy Law.

F. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Kentucky resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

G. Disclosure of Personal Information.

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

Category of Personal Information	Category of Third Party
Identifiers	Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers.
Protected Classifications	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Commercial Information	Third party service providers; third party business partners; credit reporting agencies; data analytics providers.
Biometric Information	Third party service providers; third party business partners.
Online Activity	Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers.
Geolocation Data	Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers.
Sensory Information	Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers.
Employment Information	Third party service providers (e.g., employers of consultants); third party business partners; credit reporting agencies; data analytics providers.
Education Information	Third party service providers; third party business partners.
Inferences	Third party service providers; third party business partners; digital advertising providers.
Sensitive Personal Information	Third party service providers; third party business partners; credit reporting agencies.

12. MARYLAND PRIVACY RIGHTS – APPLICABLE ONLY TO MARYLAND RESIDENTS

If you are a Maryland resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 12.A. below); (B) request that we correct your inaccurate Personal Information (see Section 12.B. below); (C) request that we delete your Personal Information (see Section 12.C. below); (D) obtain a portable copy of your Personal Information (see Section 12.D. below); and (E) request a list of categories of third parties (see Section 12.E. below); and (F) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 12.F. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Maryland Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Maryland resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Maryland resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Maryland resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Maryland resident and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests for List of Categories of Third Parties

You have the right to request a list of the categories of third parties to which we have disclosed your Personal Information, subject to certain exceptions. If you are a Maryland resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

F. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Maryland Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Maryland resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Maryland Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer, as defined by Maryland Privacy Law.

G. Authorized Agent

H. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Maryland resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

I. Disclosure of Personal Information

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties.

Category of Personal Data	Processing Purpose(s)	Used for Online Targeted Advertising?	Sold or Shared
Personal Information	Notify you of special promotions, offers, and events via e-mail, direct mail, social media, telephone, text message, push notifications, in-room notifications, and other means; Validate your identity; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Employment Application Information	Perform background checks (for example, if you apply for employment with us); Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers (e.g., employers of consultants); third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Vehicle Information	Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Purchase and Transaction Information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Process financial transactions; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Sensitive Personal Information (as defined by applicable Maryland privacy law)	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Internal market research and analytics; Generate statistical studies; Determine your eligibility for casino markers and offers; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Process biometric-related information including physiological or biological characteristics used to establish individual identity, such as fingerprints or facial recognition; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies); government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Wi-Fi and Location Information	Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Device and Browser Information	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners.Shared With: Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Social Media Information	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners. Shared With: Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Video Surveillance Information	Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Audio, electronic, or similar information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
BetMGM and Other Gaming Information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request; Process financial transactions; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/AShared With: Third party service providers; third party business partners; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).

13. MINNESOTA PRIVACY RIGHTS – APPLICABLE ONLY TO MINNESOTA RESIDENTS

If you are a Minnesota resident, you have the right to (A) confirm whether or not we are processing your Personal Information and the categories of such Personal Information we are processing (see Section 13.A. below); (B) request that we correct your inaccurate Personal Information (see Section 13.B. below); (C) request that we delete your Personal Information (see Section 13.C. below); (D) obtain a portable copy of your Personal Information (see Section 13.D. below); (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 13.E. below); and (F) request a list of third parties (as defined under Minnesota Privacy Law) to which we have disclosed your Personal Information (see Section 13.F. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect, please see Section 1 (“Information We Collect”) above. For more information on how we use Personal Information and the types of third parties with whom we may share Personal Information, please see Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Minnesota Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and the Categories of Personal Information Processed

You have the right to request that we confirm whether or not we are processing your Personal Information and the categories of Personal Information we are processing, subject to certain exceptions. If you are a Minnesota resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Minnesota resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete your Personal Information, subject to certain exceptions. If you are a Minnesota resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are a Minnesota resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Minnesota Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Minnesota resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Minnesota Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer, as defined by Minnesota Privacy Law.

F. Requests for List of Third Parties

You have the right to request a list of third parties (as defined under Minnesota Privacy Law) to which we have disclosed your Personal Information, subject to certain exceptions. If you are a Minnesota resident and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

G. Authorized Agent

H. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Minnesota resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

14. MONTANA PRIVACY RIGHTS – APPLICABLE ONLY TO MONTANA RESIDENTS

If you are a Montana resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 14.A. below); (B) request that we correct your inaccurate Personal Information (see Section 14.B. below); (C) request that we delete your Personal Information (see Section 14.C. below); (D) obtain a portable copy of your Personal Information (see Section 14.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 14.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. If you need this Policy in an alternative, accessible format due to a disability, please send an email with your name and contact information to privacy@mgmresorts.com.

For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Montana Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law. We do not sell your personal information in exchange for monetary compensation. We may disclose your personal information for non-monetary compensation by allowing certain third parties (such as online advertising services and marketing partners) to collect personal information (i) via automated technologies on our websites and apps for online targeted advertising purposes and/or (ii) for marketing-related purposes. This kind of sharing may be considered a “sale” under Montana Privacy Law when the personal information is exchanged for non-monetary compensation.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Montana resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Montana resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us, subject to certain exceptions. If you are a Montana resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are a Montana resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Montana Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Montana resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Montana Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, as defined by Montana Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Montana resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

15. NEBRASKA PRIVACY RIGHTS – APPLICABLE ONLY TO NEBRASKA RESIDENTS

If you are a Nebraska resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 15.A. below); (B) request that we correct your inaccurate Personal Information (see Section 15.B. below); (C) request that we delete your Personal Information (see Section 15.C. below); (D) obtain a portable copy of your Personal Information (see Section 15.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 15.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Nebraska Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Nebraska resident, and wish to request this information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Nebraska resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Nebraska resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Nebraska resident, and wish to request this information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Nebraska Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Nebraska resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Nebraska Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as defined by Nebraska Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Nebraska resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar or calling 1-844-464-5849 and indicating that you wish to appeal our decision.

16. NEW HAMPSHIRE PRIVACY RIGHTS – APPLICABLE ONLY TO NEW HAMPSHIRE RESIDENTS

If you are a New Hampshire resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 16.A. below); (B) request that we correct your inaccurate Personal Information (see Section 16.B. below); (C) request that we delete your Personal Information (see Section 16.C. below); (D) obtain a portable copy of your Personal Information (see Section 16.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 16.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under New Hampshire Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a New Hampshire resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a New Hampshire resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a New Hampshire resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a New Hampshire resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under New Hampshire Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a New Hampshire resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with New Hampshire Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, as defined by New Hampshire Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a New Hampshire resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

17. NEW JERSEY PRIVACY RIGHTS – APPLICABLE ONLY TO NEW JERSEY RESIDENTS

If you are a New Jersey resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 17.A. below); (B) request that we correct your inaccurate Personal Information (see Section 17.B. below); (C) request that we delete your Personal Information (see Section 17.C. below); (D) obtain a portable copy of your Personal Information (see Section 17.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 17.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under New Jersey Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a New Jersey resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a New Jersey resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete your Personal Information, subject to certain exceptions. If you are a New Jersey resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a New Jersey resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under New Jersey Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a New Jersey resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with New Jersey Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as defined by New Jersey Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a New Jersey resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

18. OREGON PRIVACY RIGHTS – APPLICABLE ONLY TO OREGON RESIDENTS

If you are an Oregon resident, you have the right to (A) confirm whether or not we are processing your Personal Information and the categories of Personal Information we are processing (see Section 18.A. below); (B) request a list of third parties (as defined under Oregon Privacy Law) to which we have disclosed your Personal Information (see Section 18.B. below); (C) obtain a copy of your Personal Information (see Section 18.C. below); (D) request that we correct your inaccurate Personal Information (see Section 18.D. below); and (E) request that we delete your Personal Information (see Section 18.E. below); and (F) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 18.F. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect, please see Section 1 (“Information We Collect”) above. For more information on how we use Personal Information and the types of third parties with whom we may share Personal Information, please see Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Oregon Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and the Categories of Personal Information Processed

You have the right to request that we confirm whether or not we are processing your Personal Information and the categories of Personal Information we are processing, subject to certain exceptions. If you are an Oregon resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests for List of Third Parties

You have the right to request a list of third parties (as defined under Oregon Privacy Law) to which we have disclosed your Personal Information, subject to certain exceptions. If you are an Oregon resident and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are an Oregon resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are an Oregon resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are an Oregon resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

F. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Oregon Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are an Oregon resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Oregon Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as defined by Oregon Privacy Law.

G. Authorized Agent

H. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are an Oregon resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

19. RHODE ISLAND PRIVACY RIGHTS – APPLICABLE ONLY TO RHODE ISLAND RESIDENTS

If you are a Rhode Island resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 19.A. below); (B) request that we correct your inaccurate Personal Information (see Section 19.B. below); (C) request that we delete your Personal Information (see Section 19.C. below); (D) obtain a portable copy of your Personal Information (see Section 19.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 19.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Rhode Island Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Rhode Island resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Rhode Island resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All correction requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete your Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Rhode Island resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All deletion requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Rhode Island resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All such requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Rhode Island Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Rhode Island resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Rhode Island Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, as defined by Rhode Island Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Rhode Island resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

H. Disclosure of Personal Information

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties.

Category of Personal Data	Processing Purpose(s)	Used for Online Targeted Advertising?	Sold or Shared
Personal Information	Notify you of special promotions, offers, and events via e-mail, direct mail, social media, telephone, text message, push notifications, in-room notifications, and other means; Validate your identity; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; digital advertising providers; internet service providers; operating system and platform providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Employment Application Information	Perform background checks (for example, if you apply for employment with us); Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers (e.g., employers of consultants); third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Vehicle Information	Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Purchase and Transaction Information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Process financial transactions; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Sensitive Personal Information (as defined by applicable Rhode Island privacy law)	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Internal market research and analytics; Generate statistical studies; Determine your eligibility for casino markers and offers; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Process biometric-related information including physiological or biological characteristics used to establish individual identity, such as fingerprints or facial recognition; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies); government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Wi-Fi and Location Information	Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Device and Browser Information	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners.Shared With: Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Social Media Information	Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries, requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: Digital advertising providers and third party business partners. Shared With: Third party service providers; third party business partners; digital advertising providers; internet service providers; operating system and platform providers; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Video Surveillance Information	Security and safety; Protect our rights or property; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
Audio, electronic, or similar information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request including hotel accommodations, gaming activities, spa services, food and beverage services, retail, and entertainment; Assess and improve our products and services; Assess and improve MGM Resorts and MGM Online Services; Assess your use of MGM Resorts and MGM Online Services; Create and update customer profiles; Determine your eligibility for casino markers and offers; Internal market research and analytics; Generate statistical studies; Security and safety; Protect our rights or property; Respond to your inquiries; Perform background checks (for example, if you apply for employment with us); Process financial transactions; Manage professional development, performance, and conduct; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	No	Sold to: N/A.Shared With: Third party service providers; third party business partners; credit reporting agencies; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).
BetMGM and Other Gaming Information	Notify you of special promotions, offers, and events; Operate MGM Rewards loyalty program; Provide the services and products you request; Process financial transactions; Create and update customer profiles; Internal market research and analytics; Generate statistical studies; Respond to your inquiries; Respond to government, law enforcement, or regulatory entities and third parties in connection with litigation, investigations, inquiries requests, audits, or corporate transactions, such as mergers, acquisitions or divestitures.	Yes	Sold to: N/AShared With: Third party service providers; third party business partners; data analytics providers; government, law enforcement, or regulatory entities and third parties (e.g., in response to subpoenas or gaming regulator requests).

20. TENNESSEE PRIVACY RIGHTS – APPLICABLE ONLY TO TENNESSEE RESIDENTS

If you are a Tennessee resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 20.A. below); (B) request that we correct your inaccurate Personal Information (see Section 20.B. below); (C) request that we delete your Personal Information (see Section 20.C. below); (D) obtain a portable copy of your Personal Information (see Section 20.D. below); and (E) opt-out of processing of your Personal Information for purposes of online targeted advertising (see Section 20.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Tennessee Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Tennessee resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Tennessee resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Tennessee resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are a Tennessee resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes

You have the right to opt-out of the processing of your Personal Information for purposes of online targeted advertising (which involves the use of cookies and similar technologies). If you are a Tennessee resident and wish to opt-out of such processing of your Personal Information, then please access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies to exercise your Tennessee Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools.

We do not “sell” Personal Information or engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as those terms are defined by Tennessee Privacy Law.

F. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Tennessee resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

21. TEXAS PRIVACY RIGHTS – APPLICABLE ONLY TO TEXAS RESIDENTS

If you are a Texas resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 21.A. below); (B) request that we correct your inaccurate Personal Information (see Section 21.B. below); (C) request that we delete your Personal Information (see Section 21.C. below); (D) obtain a portable copy of your Personal Information (see Section 21.D. below); and (E) opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (see Section 21.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Texas Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Texas resident, and wish to request this information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Texas resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Texas resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that we have processed, subject to certain exceptions. If you are a Texas resident, and wish to request this information, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849 and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes (Sale and Online Targeted Advertising)

Under Texas Privacy Law, you have the right to opt-out of the sale of your Personal Information and the processing of your Personal Information for purposes of online targeted advertising (which involves the use of certain cookies placed on our sites by us or third parties). If you are a Texas resident, and: (1) wish to opt-out of the sale of your Personal Information not involving the use of cookies and similar technologies, then please visit www.mgmresorts.com/dsar or call 1-844-464-5849; or (2) wish to opt-out of online targeted advertising or the sale of your Personal Information involving the use of cookies and similar technologies, then you must access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies (or broadcast the Global Privacy Control (“GPC”) signal). The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools. Please note that even if you opt-out of the sale of your Personal Information, we may still (i) disclose your Personal Information to service providers, contractors, and other entities for business or commercial purposes consistent with Texas Privacy Law, and (ii) disclose your Personal Information in connection with certain business transactions consistent with Section 3 (“How We Use The Information We Collect”) above.

We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as defined by Texas Privacy Law.

F. Authorized Agent

G. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Texas resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar or call 1-844-464-5849 and indicating that you wish to appeal our decision.

22. UTAH PRIVACY RIGHTS – APPLICABLE ONLY TO UTAH RESIDENTS

If you are a Utah resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 22.A. below); (B) request that we delete your Personal Information (see Section 22.B. below); (C) obtain a portable copy of your Personal Information (see Section 22.C. below); and (D) opt-out of processing of your Personal Information for purposes of online targeted advertising (see Section 22.D. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Utah Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Utah resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us, subject to certain exceptions. If you are a Utah resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are a Utah resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Opt-Out of Processing for Specified Purposes

You have the right to opt-out of the processing of your Personal Information for purposes of online targeted advertising (which involves the use of cookies and similar technologies). If you are a Utah resident and wish to opt-out of such processing of your Personal Information, then please access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies to exercise your Utah Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools.

We do not “sell” Personal Information, as defined by Utah Privacy Law.

23. VIRGINIA PRIVACY RIGHTS – APPLICABLE ONLY TO VIRGINIA RESIDENTS

If you are a Virginia resident, you have the right to (A) confirm whether or not we are processing your Personal Information and to access such Personal Information (see Section 23.A. below); (B) request that we correct your inaccurate Personal Information (see Section 23.B. below); (C) request that we delete your Personal Information (see Section 23.C. below); (D) obtain a portable copy of your Personal Information (see Section 23.D. below); and (E) opt-out of processing of your Personal Information for purposes of online targeted advertising (see Section 23.E. below). These rights, which are discussed more fully below, are subject to certain exceptions, which are intended, among other things, to protect the integrity and privacy of your Personal Information. For more information on the categories of Personal Information we may collect and how we may use such Personal Information, please see Section 1 (“Information We Collect”) and Section 3 (“How We Use the Information We Collect”) above. To the extent we process deidentified information (as defined under Virginia Privacy Law), we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

A. Requests to Confirm Processing of Your Personal Information and to Access Such Personal Information

You have the right to request that we confirm whether or not we are processing your Personal Information and to access such Personal Information, subject to certain exceptions. If you are a Virginia resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

B. Requests to Correct Inaccurate Personal Information

You have the right to request that we correct your inaccurate Personal Information, subject to certain exceptions. If you are a Virginia resident and wish to request correction of your inaccurate Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request correction of your inaccurate Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

C. Requests to Delete Your Personal Information

You have the right to request that we delete the Personal Information you provided to us or that we obtained about you, subject to certain exceptions. If you are a Virginia resident, and wish to request deletion of your Personal Information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request deletion of your Personal Information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

D. Requests to Obtain a Portable Copy of Your Personal Information

You have the right to obtain a portable copy of your Personal Information that you provided to us, subject to certain exceptions. If you are a Virginia resident, and wish to request this information, then please visit www.mgmresorts.com/dsar and indicate that you wish to request this information and provide the identifying information requested. All requests are subject to authentication of your identity to protect the privacy and security of your Personal Information.

E. Requests to Opt-Out of Processing for Specified Purposes

You have the right to opt-out of the processing of your Personal Information for purposes of online targeted advertising (which involves the use of cookies and similar technologies). If you are a Virginia resident and wish to opt-out of such processing of your Personal Information, then please access the MGM Resorts International Cookie Settings page at https://www.mgmresorts.com/en/cookie-settings.html and, for the T-Mobile Arena or Grand Garden Arena, a joint venture to which MGM Resorts International is a party, the T-Mobile Arena Cookie Settings page at https://www.t-mobilearena.com/arena-information/cookie-settings or Grand Garden Arena Cookie Settings page at https://www.grandgardenarena.com/arena-information/cookie-settings, respectively, on your device and turn off Targeting Cookies to exercise your Virginia Privacy Rights opt-out right. The cookie preference tools are device and browser specific. If you delete or clear cookies or change devices or browsers, then you will need to reset your cookie preferences using the above tools.

We do not “sell” Personal Information or engage in profiling in furtherance of decisions that produce legal or similarly significant effects, as those terms are defined by Virginia Privacy Law.

F. Right to Appeal MGM’s Decisions Regarding Your Requests

If you are a Virginia resident, then you may appeal our decision with respect to a request you have submitted by visiting www.mgmresorts.com/dsar and indicating that you wish to appeal our decision.

24. PRIVACY-RELATED REQUESTS – OTHER JURISDICTIONS

If you reside in a jurisdiction outside of those listed above, you may submit certain privacy-related requests to us. If you wish to submit such a request, then please visit www.mgmresorts.com/dsar and follow the presented instructions to submit your request. We reserve the right to authenticate your identity to protect the privacy and security of your Personal Information.

25. SECURITY

Information maintained in electronic form that is collected by MGM Resorts International and any individual MGM Resort is stored on systems protected by industry standard security measures. These security measures are intended to protect these systems from unauthorized access. No security system is impenetrable and these systems could become accessible in the event of a security breach. We have controls in place that are designed to detect potential data breaches, contain and minimize the loss of data, and conduct forensic investigations of a breach.

Our staff is required to take reasonable measures to ensure that unauthorized persons cannot view or access your Personal Information. Employees who violate our internal privacy policies are subject to disciplinary action, up to and including termination of employment.

We cannot enforce or control the security of the computers, electronic devices, or electronic communication method(s) you may use to send e-mails and submit information to us. You are responsible for the security of the computers, electronic devices, and electronic communication methods you use to communicate with us. We are not responsible for the disclosure or interception of information you send us before we receive it.

As a standard security practice, we take reasonable steps which are generally recognized in the industry to ensure that the communication methods used to support MGM Online Services do not permit connections or communication by methods that have known security weaknesses or vulnerabilities. As such, if you experience trouble using an MGM website, it may be an indication that you need to upgrade your software to a newer version that supports more secure communication methods.

In situations where your Personal Information is collected by third parties under contract with us for performance of their contractual duties and other purposes, we require such third parties to exercise reasonable care to protect that information and restrict the use of your Personal Information to the purposes for which it was provided.

26. OTHER WEBSITES

We are not responsible for the information collection or privacy practices of other websites, including websites operated by our business partners or other third parties, including websites that might be co-branded with our name. Please review and understand the privacy policies posted on any linked sites you visit before using those sites or providing any Personal Information through such sites.

27. PERSONS UNDER AGES 13 AND 21

Certain of our areas and activities are intended for persons 21 or older. If you are under 21, you may not access or attempt to access any areas or participate in any activities that are restricted to persons 21 or older. We do not knowingly collect or allow the collection of Personal Information from persons under 13. We do not knowingly sell or share, as defined under applicable privacy law, the Personal Information of minors under 18 either with or without affirmative authorization.

If you are the parent or guardian of a person under 13 and believe that the person has provided us with Personal Information, you may contact us at privacy@mgmresorts.com and request that it be removed from our active marketing database.

28. CHANGES TO THIS POLICY

We reserve the right to revise this Policy at any time without notice. When this Policy is revised in a material way, notice will be posted on MGM websites that we control along with the revised Policy.

29. PRIVACY OFFICER

We have appointed a Privacy Officer to oversee privacy matters. Our Privacy Officer can be reached by email at privacyofficer@mgmresorts.com or by postal mail at:

Privacy Officer

MGM Resorts International

6770 S. Edmond St.

Las Vegas, NV 89118

If you gamble, use your GameSense. GameSense is a registered trademark of British Columbia Lottery Corporation, used under license by MGM Resorts International.